CVE-2021-32942

Published: Jun 9, 2021Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authorized, privileged user creates a diagnostic memory dump of the process and saves it to a non-protected location.

Affected (3)

Products: Aveva: Intouch 2017, Intouch 2020

Aveva

2 products

Intouch 2017

Intouch 2020

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Aveva Intouch 2017	All versions
Aveva Intouch 2020	All versions
Aveva Intouch 2020	Version r2

Related CWEs

CWE-312

Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

CWE-316

Cleartext Storage of Sensitive Information in Memory

The product stores sensitive information in cleartext in memory.

References (4)

https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03

Source: ics-cert@hq.dhs.gov

PatchThird Party AdvisoryUS Government Resource

https://www.aveva.com/en/support/cyber-security-updates/

Source: ics-cert@hq.dhs.gov

PatchVendor Advisory

https://us-cert.cisa.gov/ics/advisories/icsa-21-159-03

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party AdvisoryUS Government Resource

https://www.aveva.com/en/support/cyber-security-updates/

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.